linux-kernel - Re: [PATCH] input/vmmouse: Fix device name copies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 3 Dec 2023 18:41:01 +0000
From:   Dmitry Torokhov <dmitry.torokhov@...il.com>
To:     Zack Rusin <zackr@...are.com>
Cc:     linux-kernel@...r.kernel.org,
        VMware Graphics Reviewers 
        <linux-graphics-maintainer@...are.com>,
        Arnd Bergmann <arnd@...db.de>,
        Robert Jarzmik <robert.jarzmik@...e.fr>,
        Raul Rangel <rrangel@...omium.org>,
        linux-input@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] input/vmmouse: Fix device name copies

Zack,

On Mon, Nov 27, 2023 at 03:42:06PM -0500, Zack Rusin wrote:
> From: Zack Rusin <zackr@...are.com>
> 
> Make sure vmmouse_data::phys can hold serio::phys (which is 32 bytes)
> plus an extra string, extend it to 64.
> 
> Fixes gcc13 warnings:
> drivers/input/mouse/vmmouse.c: In function ‘vmmouse_init’:
> drivers/input/mouse/vmmouse.c:455:53: warning: ‘/input1’ directive output may be truncated writing 7 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
>   455 |         snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
>       |                                                     ^~~~~~~
> drivers/input/mouse/vmmouse.c:455:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
>   455 |         snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
>       |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>   456 |                  psmouse->ps2dev.serio->phys);
>       |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Signed-off-by: Zack Rusin <zackr@...are.com>
> Fixes: 8b8be51b4fd3 ("Input: add vmmouse driver")
> Cc: Dmitry Torokhov <dmitry.torokhov@...il.com>
> Cc: VMware Graphics Reviewers <linux-graphics-maintainer@...are.com>
> Cc: Arnd Bergmann <arnd@...db.de>
> Cc: Robert Jarzmik <robert.jarzmik@...e.fr>
> Cc: Raul Rangel <rrangel@...omium.org>
> Cc: linux-input@...r.kernel.org
> Cc: <stable@...r.kernel.org> # v4.1+
> ---
>  drivers/input/mouse/vmmouse.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
> index ea9eff7c8099..7248cada4c8c 100644
> --- a/drivers/input/mouse/vmmouse.c
> +++ b/drivers/input/mouse/vmmouse.c
> @@ -72,7 +72,7 @@
>   */
>  struct vmmouse_data {
>  	struct input_dev *abs_dev;
> -	char phys[32];
> +	char phys[64];

This simply wastes 32 bytes. It is perfectly fine to truncate phys
(which does not happen in real life).

-Wformat-truncation is disabled in normal builds, folks should stop
using it with W=1 as well.

Thanks.

-- 
Dmitry